Coldframe: A Honeypot Disguised as a Supermarket Freezer Controller

Starting from Real Events: Why Disguise as a Freezer Controller

Recent security incidents involving industrial refrigeration equipment sparked a developer's curiosity: if you put a sufficiently realistic fake device on the public internet, how would attackers treat it? That led to Coldframe—a honeypot specifically designed to disguise itself as a supermarket freezer controller. After being posted on Hacker News' Show HN section, the project earned 216 points and 50 comments, showing that the topic resonates strongly within the security community.

Coldframe's imagined adversary isn't the average internet user, but attackers who actively scan industrial control devices and attempt known vulnerabilities. Its design goals are therefore clear: it must not only "look right," but also withstand identification by mapping engines like Shodan at the protocol, page, and certificate levels.

A honeypot is a class of active defense and threat intelligence tool—essentially a deliberately exposed decoy system that attackers can discover and interact with. By level of interaction, honeypots can be divided into low-interaction honeypots (simulating only a few services or protocols, simple to implement but easy to detect) and high-interaction honeypots (providing a more complete system environment, capable of collecting richer behavioral data but with higher operational cost and risk). By purpose, they can be divided into research honeypots (used to observe attackers' tactics, techniques, and procedures) and production honeypots (used for early warning and entrapment). The design challenge of a honeypot lies in balancing "fidelity" and "safety": the more realistic the disguise, the more it can attract targeted attackers, but at the same time it must ensure there are no real assets inside the decoy that could be further exploited. Coldframe is a research-oriented, low-to-medium interaction vertical-device honeypot.

How Far the Disguise Goes: Even the Byte Count Matches

Coldframe simultaneously simulates two common device interfaces on the market: the Danfoss AK-SM 800A and the Dixell XWEB. The author emphasizes that both disguises are identified as real devices on Shodan, not as honeypots.

Achieving this required item-by-item comparison with real devices. The author referenced records of real devices on Shodan to match response header order, page titles, certificate fields, and TLS versions. For example, the Danfoss persona sends nginx response headers in the same order as a real AK-SM 800A; the Dixell persona omits the Server header and pads the page to exactly 8,202 bytes—a number that clearly comes from measuring a real page rather than being chosen arbitrarily.

Technically it's also lightweight enough: a single Python file using only the standard library. The project builds on eppser/danfoss-ak-sm-decoy as well as public research from Synacktiv, Claroty, and Ironhackers.

Shodan is a search engine for internet-connected devices. It continuously scans the entire IP space, harvests fingerprint information such as banners on open ports, HTTP responses, and TLS certificates, and uses this to classify and tag devices. Security researchers commonly use it to inventory industrial control devices, cameras, and databases exposed on the public internet. Precisely because Shodan's identification relies on fine-grained features such as response header order, page titles, and certificate fields, a honeypot that wants to avoid being labeled a "honeypot" must align with real devices on every one of these fingerprints. Conversely, Shodan's identification results are often used by researchers as an external benchmark for testing honeypot fidelity—Coldframe being identified as a real device is exactly the kind of validation that comes from this benchmark.

Identifying Attacks: Not Just Logging, but Judging Whether "Today's Code Is Correct"

The value of a honeypot lies in seeing attackers' actions clearly. Coldframe can identify attacks targeting Danfoss devices via CVE-2025-41450, the so-called "code of the day" login bypass, and it records whether the submitted code is correct for that day. In addition, it tags attempts targeting three other Danfoss CVEs and XWEB-related vulnerabilities.

This detail of "recording whether the code is correct" is far more meaningful than simply logging a request: it can distinguish blind scanning from attackers who genuinely understand the vulnerability details.

CVE (Common Vulnerabilities and Exposures) is a universal numbering system for public vulnerabilities, where each number corresponds to a confirmed security flaw, making it easy for vendors, researchers, and scanners to reference consistently. The "code of the day" mentioned in the article refers to access codes generated or rotated by date in certain Danfoss device login mechanisms: if an attacker knows the algorithm, they can calculate the code valid for that day and thereby bypass authentication. Therefore, a honeypot recording "whether the submitted code is correct for that day" is equivalent to judging whether an attacker is blindly credential-stuffing or truly understands the vulnerability logic—the former typically attempts fixed or random values in bulk, while the latter submits the correct code matching the current date. This distinction is very valuable for assessing an attacker's skill level.

Deliberately Letting Them In: Observing the Second Step

Coldframe has a counterintuitive design—using the default password allows attackers to log in and enter a fake store dashboard with a defrost button. The author's explanation is that this allows observation of the attacker's "second step," not just the first-step login attempt.

There's no real system behind the dashboard, so allowing access poses no risk in itself, yet it can collect more valuable behavioral data: what attackers click after logging in and which controls interest them.

One Day Online: Only Scanners

Currently two instances have been running online for a day, and the only traffic observed was from generic scanners and Shodan's crawler—the latter having a fitting domain name, refrigerator.census.shodan.io. This result itself also shows that newly deployed devices mainly face automated mapping in the short term; genuinely targeted attacks require a longer observation period.

At the end of the post, the author asks for feedback from people who have seen such devices in the field, which also highlights a practical need of honeypot projects: continuous calibration of disguise details depends on first-hand information about real devices.

A Few Observations

Coldframe reflects a trend: honeypots are moving from "generic web service disguises" toward "vertical industry device disguises." Devices in industrial control and refrigeration are often deployed at the edge and left unpatched for long periods, making them weak points in the attack surface. Using extremely low cost (a single file, standard library) to achieve high-fidelity disguise can help researchers accumulate attack samples and also let device vendors see how their products are treated on the public internet.

Of course, the limitations of such projects are also obvious: small sample size and short observation time—one day of data is not enough to draw any trend conclusions. The author himself treats it only as an open experiment rather than a mature intelligence source.